TRACE AI Labs › AI agent compliance
AI agents are being handed real decisions in hiring, finance, healthcare, and procurement. Agent compliance asks a plain question: when an agent is given a rule and a reason to skip it, which one wins?
An AI agent in an enterprise workflow is not a chatbot answering trivia. It has a role, a set of KPIs, and instructions that include the rules the company is legally bound by. It also has a user in front of it who wants something done. Agent compliance is whether the rules survive contact with that user and those KPIs. Failures here are already in the case law: Air Canada was held to a refund policy its chatbot invented, New York City's MyCity assistant told businesses to break labor law, and Workday is defending a class action over algorithmic hiring screens.
Our paper Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance, published at the 2026 AAAI/ACM Conference on AI, Ethics, and Society, isolates the levers. One procurement agent, one rule (purchases over $1,000 must use an environmentally certified vendor), twelve models, and a controlled set of changes to the situation:
Training focus, as described by each developer, did not predict any of this. Models labeled agentic-RL systems and models labeled safety-aligned assistants appear at both ends of the compliance range.
The procurement study has one rule and one domain. PACT generalizes it into an agent compliance benchmark: 3,364 items across 48 scenarios in 12 regulated domains, nine families of realistic pressure, and a scripted pushback turn. Every scenario is a place AI assistants already work and a real statute governs the decision. Scores are reported both with and without a hard compliance directive in the system prompt, so the benchmark also measures how steerable an agent's compliance is.
On the current leaderboard the best of 24 models scores 0.944 and none clears the bar for unsupervised use. One sentence of ordinary workplace pressure raises violation rates by 65%. When agents do break a rule, they describe the outcome as compliant 79% of the time, which matters for anyone relying on the agent's own audit trail.
Compliance can also erode from the inside. In Agent Memory Is a Surface for Endogenous Authorization Laundering we show that an agent's persistent memory can turn a suggestion into a standing permission nobody granted. Incremental memory updates created false authority for up to 50.2% of unauthorized requests, and once present, downstream executors acted on it in 98.6% of trials. EAL-Bench is the open benchmark for that failure.